diff --git a/.github/workflows/check.yaml b/.github/workflows/check.yaml
index 3506978..a0af25d 100644
--- a/.github/workflows/check.yaml
+++ b/.github/workflows/check.yaml
@@ -44,6 +44,13 @@ jobs:
       pull-requests: read
     with:
       dry-run: true
+  build:
+    # the release's own build, with the hashed build requirements the lock pins, so a pull request that would fail it
+    # fails here instead of after the release is tagged
+    name: 🏗️ Release build
+    uses: tox-dev/github-workflows/.github/workflows/validate-python-release.yaml@0c4cffd63033d38196319524d101caae1eef925b # 6.7.2
+    permissions:
+      contents: read
   hooks:
     name: 🧹 Hooks under the cooldown
     uses: tox-dev/github-workflows/.github/workflows/cooled-hooks.yaml@0c4cffd63033d38196319524d101caae1eef925b # 6.7.2
@@ -52,7 +59,7 @@ jobs:
   gate:
     name: 🚦 ${{ github.event_name == 'pull_request' && 'Required checks pass' || 'Non-PR checks pass' }}
     if: ${{ !cancelled() }} # codespell:ignore cancelled
-    needs: [test, release, hooks]
+    needs: [test, release, build, hooks]
     runs-on: ubuntu-26.04
     permissions: {}
     steps: